bugGNUstep - Bugs: bug #42411, gdomap chroots to /tmp

Group
 
 

bug #42411: gdomap chroots to /tmp

Submitter:  Yavor Doganov <yavor>
Submitted:  Fri 23 May 2014 04:54:06 PM UTC
   
 
Category:  Base/Foundation Severity:  3 - Normal
Item Group:  Bug Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 25 Jul 2014 01:57:06 PM UTC, comment #5: 

I'm tentatively closing this as I've added a '-j' option to specify the path to the jail directory; which gives the user of the program control over how it operates.


Richard Frith-Macdonald <CaS>
Group Member
Fri 25 Jul 2014 10:29:56 AM UTC, comment #4: 

I agree about 1 and 2 not being options.

I don't agree with (3) since if we don't chroot then we have to assume that the executable has access to the whole filesystem ... and a chroot to /tmp can't possibly be less secure than that.

Perhaps though, we could add a command-line argument to specify the directory to which we should chroot, and only use the existing location if that argument is not provided?  Then a distro could have a startup script which jails the process in a known-safe location for that distro.

Richard Frith-Macdonald <CaS>
Group Member
Fri 25 Jul 2014 10:09:37 AM UTC, comment #3: 

The bug submitter suggests:

1) create an empty directory in /run (optionally via tmpfiles.d)

2) or ship one in /usr/share/gdomap/empty-directory-for-chroot (or so) in the package itself

3) Don't chroot?  That is less broken than chroot into a
world-writable location.

I believe 1) is not portable while 2) is not acceptable as a general solution since it is distro-specific.

Yavor Doganov <yavor>
Sun 13 Jul 2014 11:05:28 AM UTC, comment #2: 

I don't know either, I'll ask the original bug submitter.

> is there a debian specific standard for this which
> could be conditionally compliled when building on a
> debian system?


I don't think so.  I believe this was not caught by an automatic security-check tool.  It's just that some people have a habit to review daemons' code and gdomap seems to be getting a lot of attention :-)

Yavor Doganov <yavor>
Sun 13 Jul 2014 07:42:10 AM UTC, comment #1: 

I don't mind making things even more paranoid, but I don't know of an empty, non-writable directory that the program can reliably move to, and creating a directory which could then not be cleaned up on program termination (because the program is chrooted inside it) does not seem an acceptable option.
Is there a standard portable way to do this (a quick internet search didn't reveal anything to me)?
Failing that, is there a debian specific standard for this which could be conditionally compliled when building on a debian system?

Richard Frith-Macdonald <CaS>
Group Member
Fri 23 May 2014 04:54:06 PM UTC, original submission:  

Another report from Debian, original URL:
http://bugs.debian.org/741441

"gdomap chroots to /tmp "as another level of paranoia". However if you are paranoid, you really want to chroot to an empty, non-writable directory, not to a world-writable one containing random files."

Yavor Doganov <yavor>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by CaS (Posted a comment)
  • -email is unavailable- added by yavor (Submitted the item)
  • -email is unavailable- added by yavor
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-07-25 CaS StatusNone Fixed
        Open/ClosedOpen Closed
    2014-05-23 yavor Carbon-Copy- Added -email is unavailable-

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code